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Abstract 



The class MA consists of languages that can be efficiently verified by classical probabilistic 
verifiers using a single classical certificate, and the class QMA consists of languages that can be 
efficiently verified by quantum verifiers using a single quantum certificate. Suppose that a verifier 
receives not only one but multiple certificates. In the classical setting, it is obvious that a classical 
verifier with multiple classical certificates is essentially the same with the one with a single classical 
certificate. However, in the quantum setting where a quantum verifier is given a set of quantum 
^ . certificates in tensor product form (i.e. each quantum certificate is not entangled with others), 

the situation is different, because the quantum verifier might utilize the structure of the tensor 
product form. This suggests a possibility of another hierarchy of complexity classes, namely the 
' QMA hierarchy. From this point of view, we extend the definition of QMA to QMA(fc) for the case 

quantum verifiers use k quantum certificates, and analyze the properties of QMA(A:). 

To compare the power of QMA(2) with that of QMA(l) = QMA, we show one interesting 
property of "quantum indistinguishability" . This gives a strong evidence that QMA(2) is more 
, powerful than QMA(l). Furthermore, we show that, for any fixed positive integer k > 2, \i 

pi ' a language L has a one-sided bounded error QMA(fc) protocol with a quantum verifier using k 

quantum certificates, L necessarily has a one-sided bounded error QMA(2) protocol with a quantum 
(~| ' verifier using only two quantum certificates. 

a ■ 

1 Introduction 



The class MA |^ |^ is a randomized generalization of the class NP. A quantum analogue of MA 
was apparently first discussed by Knill |14], was later studied by Kitaev |12|, and was named QMA 



I by Watrous ||T^. Intuitively, MA is the class of languages that can be efficiently verified by classical 
probabilistic verifiers using a single classical certificate, and QMA is the one that can be efficiently 
verified by quantum verifiers using a single quantum certificate. 

Consider a situation that a verifier receives not only one but multiple certificates. In the classical 
setting, it is obvious that using multiple classical certificates does not increase the power of the verifier 
and the classical verifier with multiple classical certificates remains the same in the computational 
power with the one with a single classical certificate. However, in the quantum setting where a 
quantum verifier is given a set of quantum certificates unentangled each other, the situation is different, 
because the quantum verifier might utilize the fact that each certificate is not entangled with others. 
From this point of view, we extend the definition of QMA to QMA(/c) for the case quantum verifiers 
use k quantum certificates, and analyze the properties of QMA(A;). 
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The most natural and important question to ask is how much stronger the quantum verifier becomes 
using two quantum certificates instead of one, or in other words, how much amount of help it is for 
the verifier to know the existence of a tensor product structure. For this question, this paper gives a 
strong evidence of the quantum verifier with two quantum certificates being much stronger than the 
one with only one quantum certificate. More precisely, we show somewhat a surprising result stated 
as follows. 

Theorem 1 Suppose one of the following two is true for given 2n qubits certificate \^): 

(a) \^){^\ £ Ho, Ho = {|^')(^'| I 3|V'), \(p) ■■ n qubits pure states, \^) = {ip) \(j))}, 

(h) £ Hf, Hf = {|^)(^'| I V|V'),|0) : n qubits pure states, O |0)(0|) < 1-e}. 

Then, for any < e < 1- 2-"/2, there is no quantum measurement better than the trivial strategy 
where one guesses at random without any operation at all. 

Note that F{-, •) in the statement above represents the fidelity, and the formal definition of the fidelity 
is given in Section ^. This theorem holds true even if we replace Hf by the set of maximally entan- 
gled states (see Lemma ^ in Section |^ . We emphasize that this theorem is a quantum information 
theoretical one, and the indistinguishability stated in this theorem holds as far as we obey the law 
of quantum physics. Thus this theorem suggests something like quantum indistinguishabilitfj^ so to 
speak. 

Although it is given above a strong evidence that using two quantum certificates is much different 
from using only one quantum certificate, this paper also points out that the situation might change 
in comparing QMA(3) with QMA(2). Let us say that a language L has a one-sided bounded error 
QMA(A;) protocol if there exists a quantum polynomial-time verifier V and a polynomially bounded 
function p >1 such that, for every input x of length n, (i) if x G L, there exists a set of k quantum 
certificates which causes V accept x with probability 1, and (ii) if x ^ L, then for any set of k quantum 
certificates, V accepts x with probability at most 1 — l/p{n). In fact, we prove the following property. 

Theorem 2 Let L be a language having a one-sided bounded error QMA[?>) protocol. Then L has a 
one-sided bounded error QMA[2) protocol. 

A key idea to prove this theorem is to make use of the fact that there is no entanglement between 
two certificates given in QMA(2) protocols. Let |Ci), IC2), and IC3) be three certificates given in 
a QMA(3) protocol. If two certificates \Di) and I-D2) given in the corresponding QMA(2) protocol 
are of the form \Di) = \Ci) ® IC3) and \D2) = IC2) (8) IC3), it is obvious that we can simulate the 
QMA(3) protocol by the QMA(2) protocol. We use the Controlled-Swap operator and construct an 
efficient test for the decomposability of \Di) and ID2) into the form above. We also show that, in the 
one-sided error cases, this Controlled-Swap test is optimal in view of error probability to check this 
decomposability. 

Actually, Theorem |2| can be generalized to the following theorem: 

Theorem 3 For any positive integer k and any r G {0, 1,2}, let L be a language having a one-sided 
bounded error QMA{3k -\- r) protocol. Then L has a one-sided bounded error QMA{2k + r) protocol. 

Applying this theorem repeatedly, we obtain the following theorem: 

Theorem 4 For any fixed positive integer k, let L be a language having a one-sided bounded error 
QMA{k) protocol. Then L has a one-sided bounded error QMA{2) protocol. 

One important point to be mentioned concerning this theorem is that we do not know if L has an 
arbitrary small one-sided bounded error QMA(2) protocol, even if L has an exponentially small one- 
sided error QMA(A;) protocol. The situations are similar even in the cases of Theorem § and Theorem 
p. It remains open for k > 2 whether running polynomially many copies of the the QMA(/c) protocol 
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in parallel (i.e. parallel repetition) reduces the error probability to be exponentially small. For this 
reason, there still remains the possibility, even in the one-sided bounded error cases, that each QMA(A;) 
does not collapse to the other and forms the QMA hierarchy. 

The remainder of this paper is organized as follows. In Section || we briefly review basic notations, 
definitions, and properties in quantum computation and quantum information theory, which are used in 
this paper. In Section ^ we give a formal definition of our model. In Section ^ we show an interesting 
property of "quantum indistinguishability" . This gives a strong evidence that using two quantum 
certificates is more powerful than using only one quantum certificate. In Section |5| we show that, for 
any fixed positive integer A; > 2, if a language L has a one-sided bounded error QMA(/i;) protocol 
with a quantum verifier using k quantum certificates, L necessarily has a one-sided bounded error 
QMA(2) protocol with a quantum verifier using only two quantum certificates. Finally we conclude 
with Section |6|, which summarizes our results and mentions a number of open problems related to our 
model. 



2 Quantum Fundamentals 

Here we briefiy review basic notations and definitions in quantum computation and quantum infor- 
mation theory. Detailed descriptions are, for instance, in |1C, 16 1. 

A pure state is described by a unit vector in some Hilbert space. In particular, an n-dimensional 
pure state is a unit vector \ip) in C". Let {|ei), . . . , |e„)} be an orthonormal basis for C". Then any 
pure state in C" can be described as Yll=i foi^ some ai, . . . , a„ G C, Y^=\ l^^jP = 1- 

A mixed state is a classical probability distribution (pi, < Pi < I, ^iPi = 1 over pure states 
This can be interpreted as being in the pure state \ipi) with probability pi. A mixed state is 
often described in the form of a density matrix p = YliPi\'^i){'^i\- density matrix is positive 

semidefinite and has trace 1. 

If a unitary transformation U is applied to a state \ip), the state becomes U\iJj), or in the form of 
density matrices, a state p changes to UpU^ after U is applied. 

One of the important operations to density matrices is the trace-out operation. Given a density 
matrix p over 7^ ® /C, the state after tracing out /C is a density matrix over H described by 

n 

tT^tcP = ^{In ® {ei\)pilH ® |ei)) 

i=l 

for any orthonormal basis {|ei), . . . , |e„)} of /C, where n is the dimension of /C and /t^ is the identity 
operator over TC. To perform this operation on some part of a quantum system gives a partial view of 
the quantum system with respect to the remaining part. 

For any mixed state with its density matrix p over TC, there is a pure state {ip) in /C for the 
Hilbert space K, of dim(/C) = dim('H) such that is a purification of p, that is, ti/c\ip){'>P\ = P- 

One of the important concepts in quantum physics is a measurement. Any collection of linear 
operators {Ai, . . . , Aj.} satisfying ^J^* = ^ defines a measurement. If a system is in a pure state 
\ip), such a measurement results in i with probability and the state becomes ||. 

If a system is in a mixed state with its density matrix p, the result i is observed with probability 
ti{AipA\), and the state after the measurement is with its density matrix AipA\/tT:{AipAl). Let us 
write Mi = A^Ai for each i. Then the measurement {^i, . . . ,Aj.} on p results in i with probability 
tr(Mjp). Statistics of results of the measurement is decided by M = {Mi, . . . ,Mfc}, and this set is 
called a positive operator valued measure (POVM). Formally, a POVM is defined to be a set of operators 
M = {Ml, . . . , Mfc} satisfying (i) Mj is a non-negative hermitian matrix and (ii) X]i=i ~ ^- -'^^'^ ^"^Y 
POVM M, there is a quantum mechanical measurement such that the probability of the measurement 
results in i is equal to ti{Mip). Therefore we may allow a little abuse of the term "measurement" 
instead of using the term "POVM" . A special class of measurements are projection or von Neumann 
measurements where {Ai,... ,Ak} is a collection of orthonormal projections. In this scheme, an 
observable is a decomposition of TL into orthogonal subspaces TLi, . . . , 7ik, that is, 7i = 7ii © • • • © 7ik- 
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More mathematically rigorous descriptions of quantum measurements are, for example, in |11, 17|. It 
is important to note that two mixed states having same density matrix cannot be distinguished at all 
by any measurement. 

The trace norm of the linear operator A is defined by 



|tr 



-trV^t^. 



In general, the trace norm \\p — a\\tT gives an appropriate measure of distance between two density 
matrices p and a. 

Another important measure between two density matrices p and a is the fidelity F{p, a) defined 

by 



F{p, a) = tr^J V^crVP. 

For any density matrices p, cr, < F{p, a) < 1 is satisfied, and F{p, a) = 1 if and only ii p = a. 
The following two are important properties on the trace norm and the fidelity. 

Theorem 5 ([|l[]) Let = {pf^ , . . . ,Pm)^ — (.Qi^ ^ • • • > Qm) probability distributions gen- 

erated by a POVM M on mixed states with density matrices p,a, respectively. Then, for any POVM 
M, l/2\p^-q^\ < \\p-a\\t,, where -q^\=ET=i \pf - Q^^l- 

Theorem 6 ([P]) For any density matrices p and a, 



1 - F{p, a) < \\p - a\\tr < V^^^^WM?- 



3 Definitions 

3.1 Polynomial-time Uniformly Generated Families of Quantum Circuits 

First we review the concept of polynomial-time uniformly generated families of quantum circuits 
according to fl^ . 

A family {Qx} of quantum circuits is said to be polynomial-time uniformly generated if there 
exists a deterministic procedure that, on each input x, outputs a description of Qx and runs in time 
polynomial in n = For simplicity, we assume all input strings are over the alphabet S = {0, 1}. 
It is assumed that the circuits in such a family are composed only of gates in the Shor basis []l8| : 
Hadamard gates, ^yo^ gates, and Toffoli gates. Furthermore, it is assumed that the number of gates in 
any circuit is not more than the length of the description of that circuit, therefore Qx must have size 
polynomial in n. For convenience, we may identify a circuit Qx with the unitary operator it induces. 



As is mentioned in ll^ , |19| , 15|, to permit non-unitary quantum circuits, in particular, to permit 
measurements at any timing in the computation does not change the computational power of the 
model. See |jl| for a detailed description of the equivalence of the unitary and non-unitary quantum 
circuit models. 

3.2 Quantum Verifier with Multiple Quantum Certificates 



Watrous ||19[ defined the class QMA in terms of quantum circuits. Here we extend this definition of 
QMA and define the class QMA(/c) for the case quantum verifiers use k quantum certificates. 

Let k be the number of certificates. For each input a; G S*, of length n = \x\, each quantum 
certificate \Ci) is a quantum pure state consists of QMiiiT-) qubits. Without loss of generality we 
assume that qmi = • • • = qMk = QM holds for some polynomially bounded function q_M : Z+ N. 
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Besides fcg^vi (n) qubits for the certificates, we have q\;{n) qubits called private qubits in our quantum 
circuit. Hence, the whole system of our quantum circuit consists of qv{n) + kqj^{n) qubits. All the 
private qubits are initialized to the |0) state, and one of the private qubits is designated as the output 
qubit. 

A (gv ) )-restricted quantum verifier 1/ is a polynomial-time computable mapping of the form 
y : S* — > S*, where S = {0, 1} is the alphabet set. For any x of length n, V{x) is a description of a 
polynomial-time uniformly generated quantum circuit acting on qv{n) + kqM{n) qubits. 

The probability that V accepts the input x is defined to be the probability that an observation 
of the output qubit (in the {|0),|1)} basis) yields 1, after the circuit V{x) is applied to the state 
|O'?vW)0|C7i)0...®|Cfc). 

Definition 7 For a positive integer k and functions a, b: [0, 1], a language L is in QMA{k, a, b) 

if there exist polynomially bounded functions qv,qM- ~^ ^ OLnd a {q\>,qM)-i"^stricted quantum 
verifier V such that, for any x of length n, 

(i) if X £ L, there exists a set of quantum certificates |Ci), . . . , \Ck) of qj^{n) qubits such that, given 
|Ci), . . . , \Ck), V accepts x with probability at least a{n), 

(a) if X ^ L, given any set of quantum certificates |C(), . . . , |C^) of q_M{n) qubits, V accepts x with 
probability at most b{n). 



For convenience, we say that a language L has a one-sided bounded error QMA(fc) protocol iff L 
is in QMA(/c, 1, 1 — for some polynomially bounded function p > 1. We also write QMA(fc) in 
short if it is not confusing to omit the arguments corresponding to the error probabilities. 

Note that the definition of the class QMA(A:, o, b) is closely related to quantum multi-prover inter- 
active proof systems which was introduced by Kobayashi and Matsumoto [15|, the model without any 
prior entanglement among provers. Of particular interest are 1-message quantum fc-prover interactive 
proof systems, which can be shown equivalent in view of computational power to the model of quantum 
verifiers with k quantum certificates. In fact, the class QMA(fc,a, 6) is equal to QMIP(A;, 1, o, 6), the 
class of languages having 1-message quantum A;-prover interactive proof systems with two-sided error 
probability (a, 6), where the provers do not share any prior entanglement before the computation. 



4 Two Quantum Certificates versus One Quantum Certificate 

First we focus on the relation between QMA(2) and QMA(l). Obviously, QMA(1, a, b) C QMA(2, a, b) 
is satisfied for any functions a, b. Concerning whether the other side of inclusion holds, it is natural 
to consider the simulation of the protocol with two quantum certificates by using only one quantum 
certificate. In this section, we show the strong implication that the simulation is impossible. 

Suppose we have a quantum subroutine which answers which of (a) and (b) is true for given 
certificate |^) G TL®'^ of 2n qubits, where Ti is the Hilbert space which consists of n qubits: 

(a) G Ho, Ho = {|^')(^'| I 31-0), !</>) : n qubits pure states, l^*) = |(/))}, 

(b) |^)(^'| G Hf, Hf ={|^')(^| I V|'0),|</') : n qubits pure states, |V^)(V^| |0)(0|) < l-e}. 

As for the certificate l^*) which does not satisfy (a) nor (b), this subroutine may answer (a) or (b) at 
random. If the subroutine answers that l^*) satisfies (b), the verifier of the QMA(l) protocol rejects. 
Otherwise, using the certificate |^'), the quantum verifier fulfills the same verification procedure as the 
one in the original QMA(2) protocol. It seems to the authors that there is no other way to simulate 
two quantum certificates by only one quantum certificate. Therefore, the authors conjecture that 
QMA(l) is strictly smaller than QMA(2), because this kind of subroutines cannot be realized by any 
physical method, which can be proven as follows. 
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In fact, we prove stronger lemma which claims that states in tensor product form cannot be 
distinguished even from maximally entangled states by any physical operation. Here, the state p = 
|^')(^'| is said to be maximally entangled if |^') can be written by 



k ^ 



i=l 



where d = 2" is the dimension of TL and {|ei), . . . , le^)}, . . . , are orthonormal bases of 

Ti [^]. Among all states, maximally entangled states are farthest away from states in tensor product 
form, and min{F(|^)(^'|, ® = l/Vd = 2-"/2. 

Lemma 8 Suppose one of the following two is true for the certificate G "H®^ of 2n qubits: 

(a) \'i>){^\ G Ho, Ho = {|^')(^'| I 3|V'), 10) G W : n qubits pure states, \^) = (g> \(p)}. 

(h) \^){^\ G Hi, Hi = I l^') is maximally entangled}. 

Then, no quantum measurement is better than the trivial strategy where one guesses at random without 
any operation at all. 

Proof Let M = {Mo,Mi} be a POVM on given |^)(^|. With M we conclude |^')(^| G H^ if 
M resuhs in i (i = 0,1). Let P^j{\^){^\) denote the probability that |^)(^'| G ^^j is concluded 
while |^')(^'| G Hj is true. We want to find the measurement which minimizes P^^(|^')(^'|) keeping 
the other side of error small enough. More precisely, we want to evaluate £ defined and bounded as 
follows. 



def 



min < maxPj^i (p) 
M IpeHo 



maxPflo(p)<5 
peHi 



> ininj/" Po^i(p)/xo(d/.) / Pflo(/>)m(dp)<4 

= -SV" ' (i„. '"*°<'"") I (in. ^ * } • 

where each pi is an arbitrary probability measure in H,. This means that £ is larger than the error 
probability of distinguishment of two states J^^y^^ppo{dp) and J^^y^^ppi{dp). Furthermore, there 
exists Pi such that 

PPo{dp) = I ppi{dp) = ^Ih^2. (1) 



peHo JpeHi d? 

Here, pQ is a uniform distribution on the set {|ej)(ej| |ej)(ej that is, Po{{\ei) {ei\®\ej) {ej\}) = 

l/d^ for each where {|ei), . . . le^)} is an orthonormal basis of TL. Similarly, pi is a uniform 
distribution on the set {\gn,m) {9n,m\]t=im=i^ that is, pi{{\gn,m) {gn,m\]) = for each n,m, where 

\9n,m) = ^ ^ ^ ^ ^ ^ ® |C(j+m)mod(i)- 

3 

This {1(71,1), . . . , \gd,d}^ is an orthonormal basis of Ti®'^ Q. Thus we have the assertion from (|^). □ 
From Lemma |8|, we can easily show Theorem |l|. 



5 k Quantum Certificates versus Two Quantum Certificates 

In the last section we gave a strong evidence that using two quantum certificates is much different from 
using only one quantum certificate. Here we point out that the situation might change if we compare 
the case of using k > 2 quantum certificates with the case of using only two quantum certificates. The 
C-SWAP algorithm described below is the key idea of our claim. 
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5.1 Utilization of Controlled-Swap 



Given a pair of n qubits mixed states p, a of the form p® consider the fohowing algorithm, which 
we call C-SWAP algorithm. A restricted version of this algorithm with an input to be a pair of n 
qubits pure states is utilized in Q. 

We prepare quantum registers B, Ri, and R2. B consists of only one qubit, both of Ri and R2 
consist of n qubits, and all the qubits in B, Ri, and R2 are initially set to the |0) state. 

C-SWAP Algorithm 

1. Set p,a in Ri,R2, respectively. 

2. Apply the Hadamard transformation to B. 

3. Apply controlled-swap operator on Ri and R2 with using B as a control qubit. That is, 
swap the contents of Ri and R2 if B contains 1, and do nothing if B contains 0. 

4. Apply the Hadamard transformation to B and accept if B contains 0. 



Proposition 9 The probability that the input p, a is accepted in the C-SWAP algorithm is exactly 
1/2 + tr(p(T)/2. 

Proof. Let B,lZi,lZ2 denote the Hilbert spaces corresponding to the qubits in B,Ri,R2, respec- 
tively. Let p = Pi 1 01 I and a = 'Ylj1j\'^3){'^j\ be decomposition of p and a with respect to the 
orthonormal bases {!</'«)}, {IV'j)} of R'i5R'2) respectively. 

We introduce the Hilbert spaces Si = /2(S"') and ^2 = /2(5^")- Then there exist purifications 

G 7^1 (8) 5i and G IZ2 ® S2 oi p and a, respectively, such that 

Now consider the following pure state ^ B ® TZi Si ® IZ2 <8> 52, 

The probability that the input pair of p, a is accepted in the C-SWAP algorithm is exactly equal to 
the probability of acceptance when the C-SWAP algorithm is applied to \^) over the Hilbert space 

i3(g)7^l (g)7^2. 

If the C-SWAP algorithm is applied to |0, we can easily see that the state \rf) G B®lZi®Si®'R.2®S2 
before the final measurement of the output qubit is given by 

\ id 

Thus the probability of acceptance is (1 + t)/2, where t is given by 

t= E V^^I'^*''I'^*^I^J'^I^J^'E VM7l^i)l'^i)l<^i)lV'j) 1 = '^Pi(lji\(t>i)\'4'j)Mj)\(t>i)) 

= ^PiQj{4>i\'^j){i'j\4'i) = E^'*^'^*!^!'^*) = ^Pi^T^{o-\4'i){4>i\) = 

i,j i i 

where (•, •) represents the inner product. This completes the proof. □ 
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5.2 Reducing the Number of Quantum Certificates 



Now wc consider reducing the number of quantum certificates k, given a QMA(A;) protocol of using 
k quantum certificates. First we consider simulating one-sided bounded error QMA(3) protocols by 
one-sided bounded error QMA(2) protocols. 

Lemma 10 For any polynomially bounded function p: Z+ — ^ M+,p > 1, 

QMA{3, 1, 1 - 1/p) C QMA{2, 1, 1 - 1/(10^^)). 

Proof. Let L be a language in QMA(3, 1, 1 — 1/p)- Given a QMA(3, 1,1 — l/p) protocol for L, we 
construct a QMA(2, 1, 1 — l/(10p^)) protocol for L in the following way. 

Let V be the quantum verifier of the original QMA(3, 1,1 — 1 /p) protocol. For the input x of length 
n, suppose that each of quantum certificates V receives consists of qjni'iT-) qubits and the number of 
private qubit of V is q\;{n). Let U be the unitary transformation which the original quantum verifier 
V applies. Our new quantum verifier W of the QMA(2, 1, 1 — l/(10p^)) protocol prepares quantum 
registers Ri,R2, Si, S2 for quantum certificates and quantum registers V,B for private computation. 
Each of Hi and Sj consists of QMi^) qubits, V consists of qv{n) qubits, and B consists of a single 
qubit. W receives two quantum certificates |-Di), 11^2) of length 2qjii{n), which are expected to be of 
the form 

\Di) = \Ci) IC3), \D2) = IC2) IC3), (2) 

where each \Ci) is the ith quantum certificate which the original quantum verifier V receives. Of 
course, each \Di) may not be of the form above and the first and the second (/x(n) qubits of \Di) may 
be entangled. Let V, B, each TZi, and each Si be the Hilbert spaces corresponding to the quantum 
registers V, B, Rj, Sj, respectively. W runs the following protocol: 



Verifier Ws Protocol 

1. Set the contents of the first qjnin) qubits of \Di) in Ri, and the contents of the second 
Qm{^) qubits of \Di) in Si. 

Set the contents of the first (/^^(n) qubits of ID2) in 1^2, and the contents of the second 
QMi.iT') qubits of \D2) in S2. 

2. Do one of the following two tests at random. 

2.1 Separability test: 

Apply the C-SWAP algorithm over ;S (8) 5i (g) S2, using quantum registers B, Si, S2. 
Accept if B contains 0, otherwise reject. 

2.2 Consistency test: 

Apply U over V T^i (8) 7?.2 5i , using quantum registers V, Ri, R2, Si. 

Accept iff the result corresponds to the acceptance computation of the original quantum 

verifier. 



(i) In case the input x of length n is in L: 

In the original QMA(3, 1, 1 — l/p) protocol for L, there exist quantum certificates |Ci), IC2), IC3) 
which cause the original quantum verifier V accept x with probability 1. In the constructed 
QMA(2) protocol, let the quantum certificates |Di), 1 1)2) be of the form iDi) = |Ci)(8|C3), ID2) = 
IC2) [Cs). Then it is obvious that the constructed quantum verifier W accepts x with proba- 
bility 1. 
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(ii) In case the input x of length n is not in L: 

Consider any pair of quantum certificates l-D^), |^2)> which are set in the pairs of the quantum 
registers (Ri, Si), (R2, S2), respectively. Let p = tV'ji^\D[){D[\ and a = 11-11^102) {D'2\. Let 
e = 1 — l/p{n) and 6 = {—l + 2e + 4\/l + £ — £^)/5. The reason why we set 6 at this value will 
be clear later in the item b. 

a. In case tr(/3cr) < 5: 

In this case the probability a that the input x is accepted in the Separability test is at 
most 



1 6 2 + e + 2Vl + £-£^ 4 + 2e-e2 (l-e? 
«^2 + 2 = 5 ^ 5 = ^-^^' 



where the second inequality is from the fact a + b > 2vo6, a > 0, 6 > 0. Thus the verifier 
W accepts the input x with probability at most 



2 2 - 10 10(p(n))2' 

b. In case tr(pa) > 6: 

tr(/9(7) > 6 means the maximum eigenvalue A of /) satisfies \ > 5. Thus there exist pure 
states \C[) £ TZi and IC3) £ Si such that 

F{\C[){C[\0\C',){C',\,\D[){D[\)>V5, 

since p = tr-ji-^\D[){D'i\. Similarly, the maximum eigenvalue of a is more than 6 and there 
exist pure states IC2) G 7^2 and \C'^) G ^2 such that 

F{\C'2){C'2\(S>\C'^){Ci\,\D'2){D'2\) > Vs. 
Thus, letting \4>) = \C[) <S) IC3) {O^) <S) \C'^) and \^) = \D[) {D'^), we have 

Therefore, from Theorem ^ we have 



, < vi-{F{\<t>){<t>\,\i^)mr < vT^. 

With Theorem |5|, this implies that, the probability /? that the input x is accepted in the 
Consistency test is bounded by 



P<£ + \/l-<52, 

since given any quantum certificates |C(), jCg), IC3) the original quantum verifier V accepts 
the input x with probability at most e = 1 — l/p{n). Noticing that 5 satisfies 

we can see that 

5 

Thus the verifier W accepts the input x with probability at most 



2 ' 2 ^ ^ 10 ^ 10(p(n))2' 

□ 
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The following theorem is an immediate consequence of Lemma |T^. 

Theorem 2 Let L be a language having a one-sided bounded error QMA{3) protocol. Then L has a 
one-sided bounded error QMA(2) protocol. 

Actually, Lemma |l^ can be generalized to the following lemma: 

Lemma 11 For any fixed positive integer k, any r E {0, 1, 2}, and any polynomially hounded function 
p: Z+ R+,p > 1, 

QMA{3k + r, 1, 1 - C QMA{2k + r, 1, 1 - 1/(10/)). 

Proof. Let L be a language in QMA(3/c + r, 1, 1 — l/p). Given a QMA(3A; + r, 1, 1 — 1/p) protocol for 
L, we construct a QMA(2/c + r, 1, 1 — l/(10p^)) protocol for L in the following way. 

Let V be the quantum verifier of the original QMA(3A; + r, 1, 1 — l/p) protocol. For the input x of 
length n, suppose that each of quantum certificates V receives consists of (n-) qubits and the number 
of private qubit of V is qvin). Let U be the unitary transformation which the original quantum verifer 
V applies. Our new quantum verifier W of the QMA(2fc + r, 1, 1 — l/(10p^)) protocol prepares quan- 
tum registers Ri,i, . . . , Ri,fc, R2,i, . . . , R2,A:, Si^i, . . . , Si^^, 82,1, . . . , 82,^, Rs,!, • • • , Rs.r, 83^1, . . . , 83,^ 
for quantum certificates and quantum registers V, B for private computation. Each of Rj j- and Sij 
consist of QMii^) qubits, V consists of qvin) qubits, and B consists of a single qubit. W receives 
2k -\- r quantum certificates . . . , |£>i,fc), |-C2,i), • • • , \D2,k), 1-^3,1), • • • , |^3,r) of length 2qMin), 

which are expected to be of the form 

= ICji) |C2fc+ii), 

\D2,ji) = \Ck+j^) ® \C2k+ji) , 
\D3,j,) = |C3fc+,,)®|0^^(")), 

for each 1 < ji < A;, 1 < j2 < r, where each |Cj) is the ith quantum certificate which the original 
quantum verifier V receives. Let V, B, each TZij, and each Si,j be the Hilbert spaces corresponding 
to quantum registers V, B, Rjj , 8ij, respectively. W runs the following protocol: 



Verifier W^s Protocol 

1. For each i,j, set the contents of the first gx(n) qubits of \Dij) in Rjj, and the contents 
of the second qMi^) qubits of \Dij) in Sij. 

2. For each j, if 83^ contains 1 in some qubit, reject. 

3. Do one of the following two tests at random. 

3.1 Separability test: 

Apply the C-SWAP algorithm over B • • • (gi Si^k) ® (52,1 ® • • • S2,k)- using the 
quantum register B, the /c-tuple of quantum registers (81,1,... ,81,^), and the fc-tuple 
of quantum registers (82,1, . . . , 82,^)- 
Accpet if B contains 0, otherwise reject. 

3.2 Consistency test: 

Apply U over V(8)7^i,i®- • •(Xi7^i,fc(Xi7^2,i®- • •®'7^2,/c®'5i,i®- • •®5i,fc(gi7^3,i®- • -07^3,^ us- 
ing quantum registers V, Ri,i, .. . , Ri,fc, R2,i, . . . , R2,fc, 81,1, . . . , 8i,fc, R3,i, . . . ,R3,r- 
Accept iff the result corresponds to the acceptance computation of the original quantum 
verifier. 



With a similar argument to the proof of Lemma IC , we can show that the above protocol is actually 
a QMA(2fc + r,l,l- l/{Wp'^)) protocol for L. □ 



The following theorem is an immediate consequence of Lemma |ll 



10 



Theorem 3 For any positive integer k and any r £ {0, 1,2}, let L be a language having a one-sided 
bounded error QMA(3k + r) protocol. Then L has a one-sided bounded error QMA{2k + r) protocol. 

Now we show that any one-sided bounded error QMA(A;) protocol can be simulated by a QMA(2) 
protocol with one-sided bounded error. 

Lemma 12 For any fixed positive integer k and any polynomially bounded function pi: Z"*" ^ M"*" , pi > 
1, there exists a polynomially bounded function p2: Z"*" M"'",p2 ^ 1 such that 

QMA{k, 1, 1 - l/pi) C QMA{2, 1, 1 - l/ps). 

Proof. By applying Lemma |ll| c = 0(log3/2 k) times repeatedly, we can easily obtain 

QMA(fc, 1, 1 - 1/pi) C QMA(2, 1, 1 - l/{W'^^~^pf)), 

for some constant c. Taking the polynomially bounded function p2 = W'^''^^pY completes the proof. 

□ 

Thus we obtain the following theorem. 

Theorem 4 For any fixed positive integer k, let L be a language having a one-sided bounded error 
QMA{k) protocol. Then L has a one-sided bounded error QMA{2) protocol. 

5.3 Optimality of C-SWAP Algorithm 

In the previous subsection, we showed how to simulate a one-sided bounded error QMA(3) protocol by 
a one-sided bounded error QMA(2) protocol using the C-SWAP algorithm. One might suspect that 
there is a better simulation than ours to avoid the increase of the error probability in the simulation. 
In this subsection, we show that the C-SWAP algorithm is optimal to check the decomposability of 
(H) with one-sided error probability. 

Let M = {Mo, Ml} be a POVM. If the result of M is 1, the certificate l^-) is judged that |^')(^'| 
is in Ho, where 

Ho = {|*)(^| 1 1*) = |Ci)|C2)|C3)|C3), \a) G n}, 

for the Hilbert space 7i of dimension d. Our problem is to derive the optimal measurement for judging 
whether |^)(^'| € Ho or not. Here we only consider one-sided error cases, hence, the measurement 
must conclude |^)(^'| G Ho with probability 1 if |^')(^| £ Hq is true. 
Define Pgym to be a projection operator in "H®^ whose image is 

span{|ei), \ei)\ej) + \ej)\ei) {I <i < d,l < j < d)}, 

where {|ei), . . . le^)} is an orthonormal basis of 7i. 

Lemma 13 In the one-sided error cases, the optimal measurement M = {Mo, Afi} to judge whether 
|^')(^'| G Ho or not is given by 

Mo = I^m Psym, Ml = 1 - Mo. (3) 

Proof. Since one-sided error is assumed, if |^')(^'| € Ho is true, the result of the measurement M 
must be always 1, therefore, for all |^I')(^| G Hq, tr(Mo|4')(^'|) = 1 is satisfied. Thus, for every 
\Ci),\C2),\Cs)en, 

Mo|Ci)|C2)|C3)|C3) = |Ci)|C2)|C3)|C3). 
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Hence, we have 

Mo > I-yim ® Psym, 

which imphes that, for any density matrix p over the Hilbert space 

tr(pMo) > tr(/)/^«2 

This means that the measurement (|3|) minimizes the probabihty of concluding |^')(^| G Hq when 
|^)(1'|0Ho. □ 

It is easy to check that our C-SWAP algorithm realizes the optimal POVM (^), and we have the 
following theorem. 

Theorem 14 In the one-sided error cases, the C-SWAP algorithm is optimal in view of error proba- 
bility to check the decomposahility of 



6 Conclusion and Open Problems 

This paper introduced the class QMA(A;) in which the quantum verifier uses k quantum certificates. 
This suggests a possibility of another hierarchy of complexity classes, namely the QMA hierarchy. It 
was given a strong evidence that QMA(2) differs from QMA(l), and was also shown that, for any fixed 
positive integer A; > 2, if a language L has a one-sided bounded error QMA(A;) protocol, L necessarily 
has a one-sided bounded error QMA(2) protocol. 

A number of interesting problems remain open in this paper. 



In the case of QMA(l) protocols, we can easily see that a parallel repetition of the protocol 
works well |13, 19|. For k > 2, does a parallel repetition of polynomially many times of the 
QMA(fc) protocol reduce the error probability to be exponentially small? 



Kitaev and Watrous [|T|, |T|, |2g] showed the PP upper bound for the class QMA(l). Is QMA(/c) 
also contained in PP for k >2? 

Can a two-sided bounded error QMA(A;) protocol be modified to a one-sided bounded error one? 

Does QMA(A;) collapse to the other for some k, or do they form the QMA hierarchy? 

Suppose that the quantum certificates be prepared by the provers isolated each other, but the 
provers share prior entanglement (cf. P]). Then how the situation changes? 
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